Changeset 207646 in webkit

Timestamp:

Oct 20, 2016, 5:15:31 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

bmalloc api should crash on failure to allocate when !isBmallocEnabled.
​https://bugs.webkit.org/show_bug.cgi?id=163766

Reviewed by Keith Miller and Filip Pizlo.

We want to crash in bmalloc on failure to allocate even when !isBmallocEnabled.
This is so that failures to allocate memory will manifest as crashes with a
unique signature (i.e. as a SIGTRAP on release builds, or as a write to illegal
address 0xbbadbeef on debug builds) and the crash will manifest inside bmalloc.
This distinguishes allocation failures from other crashing bugs that manifest as
SIGSEGVs due to random pointer dereferences in the clients of bmalloc.

• bmalloc/Allocator.cpp:

(bmalloc::Allocator::allocateImpl):
(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::allocateSlowCase):

Location:

trunk/Source/bmalloc

Files:

• ChangeLog (modified) (1 diff)
• bmalloc/Allocator.cpp (modified) (3 diffs)

trunk/Source/bmalloc/ChangeLog

@@ +1 @@
+2016-10-20  Mark Lam  <mark.lam@apple.com>
+
+        bmalloc api should crash on failure to allocate when !isBmallocEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=163766
+
+        Reviewed by Keith Miller and Filip Pizlo.
+
+        We want to crash in bmalloc on failure to allocate even when !isBmallocEnabled.
+        This is so that failures to allocate memory will manifest as crashes with a
+        unique signature (i.e. as a SIGTRAP on release builds, or as a write to illegal
+        address 0xbbadbeef on debug builds) and the crash will manifest inside bmalloc.
+        This distinguishes allocation failures from other crashing bugs that manifest as
+        SIGSEGVs due to random pointer dereferences in the clients of bmalloc.
+
+        * bmalloc/Allocator.cpp:
+        (bmalloc::Allocator::allocateImpl):
+        (bmalloc::Allocator::reallocate):
+        (bmalloc::Allocator::allocateSlowCase):
+
 2016-09-26  Yoshiaki Jitsukawa  <Yoshiaki.Jitsukawa@sony.com>
 

trunk/Source/bmalloc/bmalloc/Allocator.cpp

@@ -81 +81 @@
     if (!m_isBmallocEnabled) {
         void* result = nullptr;
-        if (posix_memalign(&result, alignment, size))
+        if (posix_memalign(&result, alignment, size)) {
+            if (crashOnFailure)
+                BCRASH();
             return nullptr;
+        }
         return result;
     }
@@ -101 +104 @@
 void* Allocator::reallocate(void* object, size_t newSize)
 {
-    if (!m_isBmallocEnabled)
-        return realloc(object, newSize);
+    if (!m_isBmallocEnabled) {
+        void* result = realloc(object, newSize);
+        if (!result)
+            BCRASH();
+        return result;
+    }
 
     size_t oldSize = 0;
@@ -187 +194 @@
 void* Allocator::allocateSlowCase(size_t size)
 {
-    if (!m_isBmallocEnabled)
-        return malloc(size);
+    if (!m_isBmallocEnabled) {
+        void* result = malloc(size);
+        if (!result)
+            BCRASH();
+        return result;
+    }
 
     if (size <= maskSizeClassMax) {